The Virtual CISO Moment

Lockbit leaks Entrust data, older iPhone vulns patch available, apps leaking hard-coded AWS creds, organ transplant system needs strengthening, "ghost in the machine" a significant risk, very experienced security reporter gets fooled by a phish, and a lookback at Stuxnet. https://www.bleepingcomputer.com/news/security/lockbit-ransomware-gang-gets-aggressive-with-triple-extortion-tactic/ https://ww...

From May 17, 2022 - Clark Cummings joins us to discuss enterprise risk management, how to recognize "risk collisions", and provide practical risk management advice for small and midsized businesses.

Scott Augenbaum was a special agent with the FBI and now continues his mission to help prevent businesses from becoming a victim of cybercrime as an author, speaker, and trainer. His story and mission is educational and inspirational! Check out https://www.cybersecuremindset.com/ and connect with Scott at https://www.linkedin.com/in/saugenbaum/.

Susan Richards is a dynamic director of Information Security concentrated in compliance, project management, application development, and database administration. She is skilled in IT Strategy, Management, Compliance Assurance, and Risk Management including HITRUST, NIST and ISO security frameworks. She is also very involved in the information security community, including ISSA chapter leadership...

Portland Oregon loses $1.4 million to BEC compromise, stolen Texas data possibly on dark web, 10 new actively exploited vulns added to CISA list, banking trojan targets industries in Spanish-speaking countries, an opinion piece on whether cybercriminals follow a moral code, and a new enterprise browser startup secures massive funding, which prompted my walk down memory lane of browsers over my 30-...

Lastpass breach, counterfeit Microsoft USB installers, deepfake getting scary, dramatic rise in DDoS attacks, Apple iOS VPNs leak, and claiming to stop all malware ignites social media storm. https://blog.lastpass.com/2022/08/notice-of-recent-security-incident/ https://news.sky.com/story/criminals-posting-counterfeit-microsoft-products-to-get-access-to-victims-computers-12675123 https://www.infose...

In this episode from May 10, 2022, Mike Rastigue with Crum & Forster joins us to discuss cyber insurance and one way that his organization is helping SMBs to be both better prepared to meet cyber insurance underwriting requirements and increase their security posture.

Vanessa Taylor is a small business owner, a business technology consultant, an educator, and a mentor. She is well-versed in many aspects of GRC and infosec risk management, and has a mission to aspire to inspire!

Entrust data leaks, cyber war insurance exclusion definition updated, vulnerable RTLS systems, crypto stolen from hacked ATMs, draft US government cybersecurity acquisition requirements, and pragmatic infosec, and why that is important. https://www.bleepingcomputer.com/news/security/lockbit-claims-ransomware-attack-on-security-giant-entrust-leaks-data/ https://www.securityweek.com/lloyds-london-in...

Apple zero-day vulns. poop hack, pregnancy app privacy concerns, UK water supply ransomware, tips for SMBs to avoid ransomware risks, and the most interesting CVE? Plus a few more thoughts on Twitter cyber drama. https://thehackernews.com/2022/08/apple-releases-security-updates-to.html https://www.bleepingcomputer.com/news/security/anonymous-poop-gifting-site-hacked-customers-exposed/ https://www....

On today's Throwback Thursday from May 3, 2022, Frank Platt of Infosec Alliance LLC (https://www.infosecalliance.com/) joins us to discuss many infosec topics, including risk management, and CMMC...and BBQ! Note a production error resulted in this TT episode releasing on Friday August 19, 2022.

In this presentation from 2014, Greg discusses SMB information security concerns with a group of small business owners in Tennessee. Most is relevant still today (though Greg notes he'd reevaluate his antivirus recommendations). Most of the video is dark (lights turned down to view slide deck off-screen).

Jack Poltorak discusses vCIO and vCISO services offered by MSSPs, how those services may not be exactly what a small or midsized business (SMB)  is looking for, and tips how an SMB can ensure they are getting the virtual CISO services they need.

BHG brief affects almost 200K, hackers target cybersecurity pros with fake job offers, Zeppelin ransomware multiple encryption, Russia wiper attacks on Ukraine, smartphone ransomware, 5G IOT API vulns, and thoughts on how to police the infosec community. https://www.scmagazine.com/analysis/breach/behavioral-health-group-informs-198k-patients-of-data-theft-from-december https://hackercombat.com/nor...

Starlink hack, Ukraine cyber chief at BlackHat, new GitHub alerts to potential vulns, new Malware as a Service, what caused that Google outage, Cloudflare phishing attack, two new tools for nonbank financial services companies, and a Cisco breach involving "MFA fatigue". https://www.wired.com/story/starlink-internet-dish-hack/ https://www.reuters.com/world/europe/ukraine-cyber-chief-pays-surprise-...

On this week's Throwback Thursday from April 19, 2022, Don Baham is very active in both the local and on-line information security communities, as well as having extensive experience helping SMBs with information security needs. He joins us to discuss challenges and opportunities including observations on the cyber security supply chain issue and possible ways to address.

CISO and vCISO Monica Rowe joins us to discuss cybersecurity in financial services; the benefits of sharing information through ISACs, presentations, and other means; and how to provide a sense of calm to the cybersecurity storm.

Critical flaws in Emergency Alert System and in some Cisco SOHO routers, new IoT threat, CISA adds Zimbra vulnerability to its Known Exploited Vulnerabilities Catalog, and what you need to do to land a six-figure cybersecurity job. https://www.threatshub.org/blog/warning-critical-flaws-found-in-us-emergency-alert-system/ https://www.theregister.com/2022/08/05/cisco_smb_routers_critical_flaws/ http...

Motherboard malware that survives OS reinstall, mobile apps leaking Twitter API keys, TVA EDR not OK, Defender defends against ransomware better, ransomware big brands migrating to more smaller bands, and Ukraine shutters major Russian bot network. https://www.pcmag.com/news/malware-that-can-survive-os-reinstalls-found-on-asus-gigabyte-motherboards https://thehackernews.com/2022/08/researchers-dis...

On this week's Throwback Thursday from April 12, 2022, Chris Bedel, President and CEO of Bedel Security (bedelsecurity.com) talks about how the virtual CISO fits in to, compliments, and enhances financial institutions' information security program and posture. He also touches on history and future of the virtual CISO. If you're a virtual CISO for financial institutions or are interested in how a v...

Steve Mallard has over 20 years in Information Technology; is a Master Teacher in Information Technology/Infrastructure Management and Information Systems Manager at Tennessee College of Applied Technology - Shelbyville; is a private consultant for government organizations, higher-ed, and private corporations, a technical writer, and a public speaker on cybersecurity. He has also organized for man...

More Pegasus, Chrome extension steals emails and creds, increase of critical infrastructure attacks, Robin Banks PhaaS, more Log4Shell, and top security news websites. https://www.reuters.com/technology/exclusive-eu-found-evidence-employee-phones-compromised-with-spyware-letter-2022-07-27/ https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetec...

Arrests in nuclear plant attack, RaaS providers adjust business plans, new cybersecurity House legislation passes with significant bipartisan support, how to make risk assessments better, PrestaShop critical vulns exploited, new CMMC AB draft assessment guide, why it's a good idea to establish a solid relationship with a recruiter (e.g. it may reduce chance of being ghosted). https://thehackernews...

On his week's Throwback Thursday from April 5, 2022, Bob Quandt, owner of Bullseye Compliance (https://bullseyecompliance.com) joins VCM for a conversation that ranges from issues and trends in SMB security, entrepreneurship and making a difference, fitness and stress management, application of military experience to infosec, and more!

In this special Wednesday episode, from the CU Intersect Conference in Houston Texas July 19, 2022, vCISO Services, LLC Principal Greg Schaffer discusses how credit unions and other small and midsized businesses can optimize their vCISO to maximize their information security posture.